If you set up logstash to monitor \/var\/log, you may get errors like this:<\/p>\n
\n{:timestamp=>\"2015-12-21T17:21:42.809000+0000\", :message=>\"failed to open \/var\/log\/auth.log: Permission denied - \/var\/log\/auth.log\", :level=>:warn}\n{:timestamp=>\"2015-12-21T17:21:42.828000+0000\", :message=>\"failed to open \/var\/log\/kern.log: Permission denied - \/var\/log\/kern.log\", :level=>:warn}\n<\/pre>\nFortunately this is easy to fix – by default logstash creates it’s own user and group, and you can add it’s user to the group that owns these log files:<\/p>\n
\nsudo usermod -a -G adm logstash \nsudo service logstash restart\n<\/pre>\n","protected":false},"excerpt":{"rendered":"If you set up logstash to monitor \/var\/log, you may get errors like this: {:timestamp=>”2015-12-21T17:21:42.809000+0000″, :message=>”failed to open \/var\/log\/auth.log: Permission denied – \/var\/log\/auth.log”, :level=>:warn} {:timestamp=>”2015-12-21T17:21:42.828000+0000″, :message=>”failed to open \/var\/log\/kern.log: Permission denied – \/var\/log\/kern.log”, :level=>:warn} Fortunately this is easy to fix – by default logstash creates it’s own user and group, and you can add it’s … <\/p>\n